Compile release binaries on the self-hosted runner in Russia - #16
Merged
Conversation
The Russian software registry filing declares where the source is stored and where the product is compiled, so release binaries have to come off a machine that matches that declaration. The release build matrix (Win32, x64, ARM64) moves to the self-hosted runner (labels: self-hosted, windows, adler); CI_build, CodeQL, dependency review, and the compatibility smoke stay on GitHub-hosted runners. The workflow only starts on tag pushes and manual dispatch, so no pull request from a fork can execute code on that machine. Adds a manual Runner self-test workflow that builds every platform on the runner without publishing anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A manual dispatch executes the workflow file and the build scripts of whatever ref the dispatcher picks, so any write-capable account could have run arbitrary branch code on the persistent runner. Both jobs now require the default branch (release also accepts v* tags), and the release job that depends on the build is skipped along with it. The self-test also runs CleanPackage before Package, so an incremental build on the persistent runner cannot make the job pass without a real recompile. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Russian software registry filing declares where the source text is stored and where the product is compiled. Release binaries therefore have to come off a machine that matches that declaration, not a GitHub-hosted runner in the US.
Changes
release.yml: thebuildmatrix (Win32, x64, ARM64) runs on[self-hosted, windows, adler]with a 90-minute timeout.version,compatibility-smoke, andreleasestay onwindows-2022.runner-selftest.yml: a manualworkflow_dispatchjob that builds every platform on the runner and reports the machine specs. It publishes nothing.Safety
release.ymltriggers only onpushof av*tag and on manual dispatch. Pull requests — including forks — never reach the self-hosted runner;CI_build, CodeQL, dependency review and Actionlint keep running on GitHub-hosted runners.Runner
adler-white-1w-npp-mte, registered against this repository, online, labelsself-hosted, Windows, X64, adler. Xeon E5-2680 v4, 64 GB RAM, 578 GB free.Merge only after the MSVC C++ toolchain (x86/x64/ARM64 + Windows SDK) is installed on that machine and
Runner self-testpasses — the installation currently needs a reboot of the host.🤖 Generated with Claude Code